Control permissions given to a user on the roles provided and create new roles based on the roles present in the organization.

How does this work?

As a company grows and onboards more users, there is always a need to regulate access for the team members.

Why do you need Roles and Permissions?

• To match the agent role in your company to their role in your account.

For example, a customer support team may want to create new FAQ articles but not launch marketing campaigns, or a Sales Development Representative (SDR) may need access to view and edit contacts but may not need access to delete a contact or edit a marketing journey.  In such cases, Admins can create roles that grant requisite permissions to users.

• To manage large teams

Manage teams spread geographically across different regions or departments (pre-sales, sales, customer support, engineering, etc). For example, you can restrict pre-sales and customer support teams from accessing conversations specific to their departments, or you can allow an agent with an Admin role to manage settings and view the Dashboard and Reports of only their teams.

The available roles are:

• Account Admin

• Administrator

• Support Agent

• Support Manager

• Marketing User

• Marketing Manager

• Restricted User

• Sales User

You can also create custom roles with granular access permissions. 

How to create customized roles?

To create custom roles,

1. Go to Admin Settings > Teams & Territories > Roles

2. Click Create Role

3. Enter the role name and choose the permissions you want to clone.

4. Choose the default scope:

   • All Records: Allows agents to access data across the organization.

   • Territory Only/Group Only: Allows agents to access data by territories. This is ideal for sales teams that are defined by regions, sources, etc.
     
     Group Only access is ideal for support agents. For example, they can add private notes on conversations only if they are part of the group to which the conversation is assigned.
     
     

   • Owned Only: Allows agents to access their owned records only while restricting their access to other users’ data.
     
     

5. Click Next to proceed.
   
   

6. Choose the relevant permissions for the role. Administrators now have the ability to define distinct scopes within each Action Permission

The different categories of permissions are:

• Modules: Allows admins to configure module-level permissions for users.
  

Admins can set up granular scope for every action mentioned below:

1. View - Select the scope for View permissions

2. Edit - Select the scope for Edit permissions

3. Delete -  Select the scope for Delete permissions

This is applicable to Contacts, Accounts, and Deals. It will also contain scopes for the permissions of any custom modules that may be created. If the admin wants to remove edit/delete access, they can select the "Can’t Edit"/”Can’t Delete” option.

Note: Global, Territory and Restricted scopes are supported for custom modules and are available in the Enterprise plan.

• CPQ Modules: Control access to Products and Quotes modules with Global/Restricted Scope. This scope is applicable across all permissions(View, Edit, Edit all, Delete owned)
  
  

• Sales Activities: All Sales Activities, such as Tasks, Meetings, Call Logs, and Custom sales activities, fall under this category. The access to all these activities will be ‘Related Access.’ This means users can access and edit tasks and appointments of only those records that fall under their scope. 

Note: The permissions selected for custom sales activities will apply to all configured sales activity types. 

For example, your Sales Development Representative can access Tasks and Appointments while still being revoked access to custom sales activities.

• Actions: This includes all record-related actions such as Create, Import, Assign, and Share. You can restrict users from searching for records under specific modules using Search records permissions. 

For example, a vendor with access only to the Contacts module in your web application can be restricted to searching for records under the Contacts module alone.

In the case of our example, for a Sales Development Representative, you can choose to allow access to all actions except importing and merging deal records. 

With the Access Views permission, you can restrict users only to view specific modules on the Left Navigation Bar and List Views. 

For example, if the Deals module is turned off under 'Access View', the Deals module will not be accessible for Users in the List View. Users can navigate the Account details page and create or view related deals.

• Quotas and Forecasting: This category encompasses permissions associated with Quotas and Forecasting. Admins can adjust the range of linked features by selecting or deselecting the available choices.

For instance, in our scenario, a Sales Development Representative could be permitted to solely view the team’s quotas without the ability to make edits.

• Activity Goals: All permissions related to Sales Goals fall under this category. Admins can modify the scope to sales goals-related features by checking/unchecking the options.

In the case of our example, for a Sales Development Representative, you can grant the user access to view all team goals but enable access to create goals only for himself. Similarly, you can also disable access to 'Recalculate a goal.'

• Analytics: This includes all permissions for Reporting and Analytics. Admins can control the scope of Analytics or a specific Reporting feature. For example, you can allow a support agent to access all Analytics features but restrict them from exporting any report.
  
  

Note: All permissions under analytics depend on the ‘View’ approval—for example, disabling view permissions for 'Marketing Emails'disables the Marketing Dashboard.

• Emails: All permissions related to email functionality, such as access to Sharing Email Templates, Setting limits for Individual emails, and bulk emails, fall under this category.
  
  All shared templates are read-only for all users other than the template's creator. Admin can restrict the sharing scope. The following options are available under sharing scope.

  1. Everyone - Public templates are shared with all users/teams/territories in the account.

  2. My teams - Users can select specific Team names to share with all users in that team. 

  3. My Territory - Users can select specific territory names to share with users under those territories.

Connect your mailbox permission will be enabled by default for all roles. Admins can refrain their users from syncing their mailboxes with the web application by unchecking this option. If this permission is disabled, all the users associated with this role will not have permission to connect their mailbox to the web application. Suppose the permission is disabled for a user with their mailbox connected to the web application. In that case, they will retain their already synced conversations, but their mailbox will be disconnected, and the connect your email tab will display a message that the user cannot connect their mailbox.

Admins can define email limits for the following:

1. Individual emails or transactional emails sent out per day

2. Bulk emails sent per day

In the case of our example, for a Sales Development Representative, you can allow access to all actions except sharing email templates. This setting will hide the share option on the email template for the user. You can also set bulk and individual email limits for the user. This places a cap on the number of emails that the user can send from the web application.

Note: Admin can also restrain the user from sending Emails by unchecking the checkbox under Email custom roles.

• Sales Sequences: All permissions related to Sales sequences, such as access to the Sales sequence page, the ability to create and share sequences, and setting limits for the maximum number of emails sent via sales sequences, fall under this category.

In the case of our example, we can allow the Sales Development Representative to view all Sales sequences while restricting permission to create sales sequences only for contacts. Similarly, we can also set the limit as 4000 emails per day as part of the Sales sequences.

Note: A user needs ‘View’ access to access the Sales Sequences page. Users who do not have Sales sequences ‘View’ access will still be able to add contacts to existing sequences by choosing the ‘Add to sequence’ option from the list view and the landing page of the record.

• Marketing Lists: All permissions related to Marketing lists such as access to lists, moving contacts to a list, copying contacts from a list, and deleting contacts from a list.
  
  

In the case of our example, we can allow the Sales Development Representative to view, create, and edit Marketing lists.

• Phone: Permission to access the phone widget. Under the phone permissions, the following are offered:

Access to Phone: This permission governs access to the phone module. When disabled, the user will not be able to find the phone module on the left navbar. Their access to make or receive phone calls
 will also be disabled. Similarly, they will not be able to access past phone conversations, phone conversations, or voicemails from the details pages. 

Allow users to receive and make phone calls: When disabled, this permission revokes user access to make or receive phone calls through the phone widget. However, they can still view past phone conversations in the activity timeline and under the conversations list view. Similarly, they can view and access phone conversations made by other users but will not be able to make phone calls on their own.

NOTE:  Enable this permission to use the built-in phone dialer or phone apps built from our marketplace.

In the case of our example, you can choose to grant access to the Sales Development Representative to access the phone widget. Additionally, you can also regulate if the user can make or receive phone calls. Click the checkbox off, will prevent the user from making or receiving calls inside the CRM.

However, if you are looking to create a role for a sales intern, the user does not need access to make receive or make calls but would still need to view and listen to the phone conversations made by senior representatives under his assigned contact view. This can be done by configuring the following permissions:

1. Access to Phone - Enabled

2. Allow users to receive and make calls - Disabled

• Marketing Campaigns: All permissions related to Marketing campaigns, such as access to email campaigns, marketing segments, and journeys, journey, and transactional emails.

In the case of our example, you can choose to grant access to the Sales Development Representative to perform all actions, Email campaigns, and transactional emails. However, grant-only view permissions over marketing segments and journey emails. You can also hide marketing journeys.

• Tickets: Includes permission to access Freshdesk tickets. 

Note: This permission is available only to customers on the Customer Support Service Suite. The agents with this permission can directly access and manage tickets on Freshdesk. Here’s the mapping of roles in Freshchat to Freshdesk:

1. Support agent - Agent (Global scope)

2. Support manager - Supervisor (Global scope)

3. Administrator - Administrator (Global scope)
Account admin - Account admin (Global scope)

• Lead Generation: Includes permission to Landing Pages and Web Forms.
  
  

• Chat Inbox: Includes permissions to manage triggered and in-app messages, canned responses, meetings, files, and more. The below scopes are applicable to the Chat inbox:

  1. Global access: Users can access all records

  2. Group access: Can access assigned records and records in their groups

  3. Restricted access: Can access only assigned records
     
     

• SMS: All permissions related to SMS settings fall under this category. Admins can configure the permissions to send Individual and Bulk SMS by checking/unchecking the options. They can also configure the number of SMSes that can be sent per day.

In the case of our example, we can allow the Sales Development Representative to send a maximum of 500 Individual SMSes and 300 Bulk SMSes per day.

• Collaboration: Permission to collaborate on deals through Slack integration.
  
  
  
  

• User Settings Permissions: All permissions related to User Settings fall under this category. Admins can configure access to a user's access to various user-specific features, such as requesting a demo, creating a support ticket, downloading the mobile app, accessing the knowledge base, etc., by checking/unchecking the options.
  
  
  
  

• Admin Settings Permissions: All permissions related to Admin settings falls under this category. Admins can configure access to Admin settings by checking/unchecking the options.

In the case of our example, for a Sales Development Representative, you can disable access to manage users or export data and restrict their role to access only workflows and territories.

Update: Admins can also enable or disable permission to web forms to other user roles by checking the 'Manage classic webforms' checkbox. When permission to web forms is enabled for a specific role, the user will be able to create, view, edit and delete web forms.

Note: All permissions under reports are dependent on the ‘Access Admin Settings’ permission. Unchecking this option would disable the Admin Settings functionality for the user and hide the buttons from the user’s application.

To modify permissions for individual fields, refer to this article

How to add users to a customized role?

1. Go to Admin Settings > Teams & Territories > Roles

2. Click on a role 

3. In the permissions page of the role, click on the Assign users button. You will be presented with an ASSIGN USERS overlay.

4. Select a user by clicking on the check box next to the user.

5. Click Assign. The user will be assigned to the role.